Challenge 3 — Solution

Task: Write a short comparison (4-6 sentences) of building the
Intermediate capstone blog by hand versus building the same blog in
Laravel using Eloquent and Blade — covering what would be faster, what
would be more educational, and one specific risk of relying entirely
on a framework without understanding what it's doing underneath.

Building the blog in Laravel would be substantially faster in practice
- Eloquent replaces every hand-written prepared statement in the
Intermediate capstone's Post class with a handful of conventions-driven
one-liners (Post::all(), Post::find($id), Post::create([...])), and
Blade's @csrf directive and {{ }} auto-escaping remove the need to
manually wire up CSRF tokens and htmlspecialchars() calls throughout
every view, as the original capstone had to do explicitly. Building it
by hand, as the Intermediate capstone actually did, is far more
educational precisely because it forces every one of those steps to be
written and understood individually - the prepared statement, the
escaping call, the session check - rather than trusting that a
framework convention is quietly doing the right thing behind the
scenes. The specific risk of relying entirely on a framework without
understanding what it's doing underneath is that a developer who has
never seen SQL injection actually happen, or watched an unescaped
value break out of an HTML attribute, is poorly equipped to recognize
the rare case where a framework's own convention doesn't apply cleanly
- for example, when raw user input needs to be dropped into a genuinely
dynamic Eloquent query (via DB::raw() or similar), the automatic
protections can be bypassed entirely, and only someone who understands
why prepared statements matter in the first place would recognize that
danger and avoid it.

Notes:
- This deliberately mirrors the chapter's own "Chapter 3's mini-
  framework wasn't wasted effort" tip-box - the comparison's own
  conclusion is that speed and education are genuinely in tension here,
  not that one approach is simply better than the other.
- The specific risk named (DB::raw() bypassing Eloquent's automatic
  SQL-injection protection) is a real, concrete Laravel escape hatch,
  not a hypothetical - chosen deliberately to make the risk specific
  rather than a vague "frameworks can be dangerous" statement.